Work-ledger — Executive recommendation (Synthesis)

Recommendation: BUILD A LIMITED MVP — the schema + claim primitive now, validation-gated, packaged as the fleet monitor’s data layer, not a fourth product. Own the irreducible core (one durable table, atomic SKIP LOCKED claim, typed endpoints, 5 SQL views); compose everything else (Temporal = execution truth, Grafana = human surface, blocking questions in-table for v1). The disposition/cost audit half is built but stays provisional until VA-10 closes (Tomas confirms he’ll read it). No open-source foundation. No standalone-product framing until a promotion trigger fires. Confidence: high on the claim primitive + durable table (structural evidence, no market alternative); medium on the audit half (mechanism sound, demand unvalidated); the “fourth product” framing from plan 001 is dropped — this research’s one material amendment to the BUILD THIN verdict.

Fulfills executive-recommendation.md (research brief §18). Decision inputs: docs 01–14 this folder; 28-agent research workflow, 2026-07-18/19; five research passes (competitive, OSS, prior-art, Temporal-native, repo recon), 5-advisor board, steelman court, 3 verification audits (27 findings, all resolved).

The decision, against the brief’s full option set

Option	Verdict	Why
Build from scratch (full)	✗	Product-shaped bureaucracy around ~150 LOC — Jobs-lens critique upheld
Build a limited MVP	✓	Smallest thing testing the riskiest assumptions; walking skeleton = production skeleton (01 §prototype)
Build on open-source foundation	✗	beads’ own Postgres backend rolled back 2026-07-16 (#4847), Dolt-only 2026-07-18 (#4881); every candidate ≤~30% coverage, integration > build (06)
Buy / license	✗	Nothing sold in 2026 covers the bundle: atomic 64-concurrent claim + durable dispositions + per-unit cost + Temporal projection (05)
Integrate existing (Temporal-native)	✗ as substitute	~30% coverage; retention purges dispositions/cost from persistence + visibility, kill gates need months; adopt its real parts (workflow-id claim v2, workflow_executions projection) as inputs (02 §1.2)
Partner / white-label	✗	N/A — internal, 2 human users
Managed service (concierge)	✗ as end-state	Runner-up (3.19 vs 4.53); collapses into week-0 of the build — run the markdown probe, then stand up the table the monitor needs anyway (11)
Process changes only	✗	ADR log adopted for component-tier dispositions (free, already trusted); breaks at unit-tier cardinality (~1000 units); file-based trackers proven lost-update-unsafe at 2 agents (02 §1.2)
Pivot	Partial	The packaging pivot IS the recommendation: monitor’s data layer, not standalone product
Postpone / abandon	✗	The monitor — Robert’s committed first deliverable — needs the identical table on day one; postponing the table postpones the commitment

What the evidence actually supports

Confirmed, structural (build on this):

• Retention wall: self-hosted Temporal purges closed workflows from persistence + visibility (Archival = replay-only blobs); kill gates M4/M8/M12 need units queryable for months. Mechanical incompatibility, not preference. (72h is the operate-skill example value — the argument stands at any realistic setting.)
• No market coverage: no 2026 product or OSS project covers the five-part scope; ceiling ~30% (Temporal-native/hatchet), rest ≤25%. beads — the one purpose-built candidate — retreated from Postgres days before this research.
• The monitor dependency: task-level fleet metrics (research/12 §2, [E7]) require this exact table regardless of any collision ever occurring. This is what makes “abandon” incoherent.
• Concept robustness: survives 3 of 4 problem reframings (coordination, accounting, memory) with dated evidence; survives “trust” only as intent (02 §1.1).

Contradictory / honest weaknesses (the board’s case):

• Zero observed incidents. No collision, duplicate-work, or lost-update event is documented in Robert’s fleet at current (~10-agent) scale. The justification is modeled + borrowed (arXiv preprint = hypothesis-grade, different system; the two rotting stranglers [E6] predate the fleet — a process failure, not concurrency evidence).
• Tomas has never been asked whether he’ll read a disposition table over the ADR log he already trusts — all five advisors independently converged on this as the missing fact.
• The ledger fixes the wrong bottleneck if review capacity is the ceiling ([E8]: AI PRs wait 4.6× longer, 32.7% vs 84.4% acceptance) — it prevents a worse failure (silent duplication), it does not raise throughput.
• Accepted unknown: claude-task-master never evaluated — cannot flip the verdict (any tracker still fails the durability + substrate requirements that eliminated the category).

Recommended shape

Build (own): work_units (+ disposed_at), append-only work_unit_events, blocking_questions, cost entries; FOR UPDATE SKIP LOCKED claim with lease + heartbeat + stale takeover; typed endpoints (register / claim / heartbeat / transition / block / unblock / cost / dispose + reads); 5 views (v_queue_depth, v_stall_list, v_cost_per_unit, v_rework, v_disposition_summary). One Encore internal-plane service technically (registerInternalService); product-wise it ships inside the fleet-monitor deliverable — same lane, same sprint, no separate roadmap.

Compose (build none): Temporal = sole execution truth; existing workflow_executions projection; Grafana = entire human read surface; grpn_ bearer token = external-agent auth (fleet agents and harness alike); ADR log = component-tier dispositions.

Do not build: UI/kanban/comments/priorities/notifications; parallel lifecycle mirror of Temporal (pre-mortem #2’s two-truths trap); attempt-level cost before a rework number demands it; v1 Temporal projection (no real unit workflows exist; wiring means editing the workflow-proxy interceptor — an explicit v2 ask, not a passive read).

UX direction: the API is the product’s only screen — full-state-in-every-response, DB-enforced transitions, error strings that name the violated invariant + legal next actions (zero-shot usability is a gated test, VA-03, not an assumption). Human surface = 5 Grafana panels + one kill-gate SQL view; a served page only if ≥3 humans ever need it interactively.

Promotion trigger (schema → standalone product): a second fleet (Tomas’s) claims through it, or the v2 projection lands. Until then “work-ledger” names the schema + endpoints.

Five-advisor verdict (principle-based simulations, not endorsements)

Advisor	Verdict	Their bar, and what this plan adopted
Steve Jobs	back with changes	“The process outgrew the artifact” — adopted: dropped fourth-product framing; one table, one claim function, one enum
Jony Ive	back with changes	Craft must move to where the hands are: the error-message surface — adopted: error strings specced verbatim in 07, zero-shot test gates the build
Marty Cagan	back with changes	Test riskiest assumption before building the accounting layer — adopted: claim()-first sequencing, VA-01/VA-10 gate the audit half
Teresa Torres	back with changes	Smallest live test, let taxonomy emerge from observed use — adopted: 2-week instrumented sprint, checkpoints with pivot branches
Clayton Christensen	back with changes	Build the job felt today (claim); let the hypothetical job (kill-gate evidence) wait until weeks-not-months from being hired — adopted: disposition half provisional until VA-10

Immediate next step + next three experiments

Now (this week): send Tomas two things in one message — the VA-10 question (“will you read a disposition table at M4, or the ADR log?”, ~5 min) and the A1 lane ask (research/14 draft, already written). Neither blocks the experiments below.

1. Fake-door protocol test (day 1–2): put the CLAUDE.md claim-protocol paragraph into fleet prompts against a stub endpoint — measures whether agents even follow it, before the service exists.
2. Zero-shot usability (day 2–3, VA-03/04): fresh sessions, only the protocol paragraph + error strings; ≥75% correct claim/transition/conflict handling.
3. 3-agent live trial vs concierge week (day 3–7, VA-01/02): walking skeleton (schema + claim + race test — plan 001 TDD step 1 verbatim) against real Orders prep units, in parallel with a hand-curated markdown ledger; measures whether collisions/rework exist at all at current scale.

Maximum justified investment before further validation: the 14-validation-plan 2-week window — nothing beyond the v1 surface before Checkpoint 2 (2026-08-02), and week 2 only on a Checkpoint-1 GO. No cloud infra (billing gate stands [E5]); local encore run + Docker PG only.

Pivot / kill criteria

Trigger	Decision
Tomas: “ADR log, not a table” (VA-10 negative)	PIVOT — fold disposition/cost half into ADRs; keep claim/transition/block primitive
Zero collisions in both trial arms across 2 weeks	FOLD — schema ships (monitor needs it); standalone framing dies; PRD Q1 closes toward “fold”
A1 rejected, A-lite confirmed	PIVOT (placement) — same build, Robert-owned repo, API-only
A1 rejected, A-lite blocked	ESCALATE — do not build homeless
<50% of fleet work flows through claims after 4 weeks of operation	KILL as product — fold surviving tables into monitor schema
Zaruba ships unit tracking in workflow-management	FOLD immediately — one-way door, do not compete inside his repo
Rebuild program pivots/dies	Graceful shutdown is a feature: final disposition export is the committed last deliverable

Ten founder questions (hardest, must be answerable before scale-up)

1. Has a claim collision or duplicate-unit incident actually happened at today’s ~10-agent scale — or is the entire failure mode modeled? (VA-01)
2. Will Tomas accept a Postgres disposition table as kill-gate evidence over the ADR log he already trusts — in writing? (VA-10)
3. Where does this live — A1 lane or A-lite repo — and what date forces that decision?
4. What observable event promotes work-ledger from “monitor’s schema” to product — and who is watching for Zaruba building the same thing natively?
5. Does the ledger measurably reduce rework versus worktree discipline alone, and what number would end that debate? (VA-02)
6. Can a fresh agent use the API correctly zero-shot from one CLAUDE.md paragraph — and if not, whose job is the fix: the prompt or the API? (VA-03)
7. What cost-attribution tolerance against actual Anthropic billing makes “verified throughput” trustworthy rather than vibes-grade? (VA-12)
8. Who maintains this in month 6, when Robert’s review hours are the program’s scarcest resource [E8] — and what is its maintenance budget in hours/month?
9. If review capacity — not claim safety — caps throughput, what is the ledger’s honest contribution to the program’s actual bottleneck?
10. When the rebuild program ends, what happens to the record — is the final disposition export committed as a deliverable, and who receives it?

Provenance

Research executed 2026-07-18/19: 28-agent workflow (5 research, 5 advisors, 2 steelman, 13 writers, 3 verifiers; ~3.6M subagent tokens; 1 agent lost post-delivery — 10-architecture.md content unaffected). Verification: 27 findings (1 blocker — PRD/build-vs-buy packaging contradiction, resolved as above; 10 major; 16 minor) — all fixed 2026-07-19. Advisory board and steelman outputs are principle-based analytical simulations, not quotations or endorsements.